insider-threat-detection-queries (16)

Hunt Hypothesis

Intent:

• Use MTP capability to look for insider threat potential risk indicators
• Indicators would then serve as the building block for insider threat risk modeling in subsequent tools Definition of

KQL Query

// --------------------------------------------------------------------------------------------------------------------------- //
//
//High Volume File Copy Operation
//
//Copy large number of files (over 100) within a 5 minute timespan
//Unfortunately there does not appear to be an easy way to determine that a file originated from a network share
DeviceFileEvents
| where FileName endswith ".docx" or FileName endswith ".pptx" or FileName endswith ".xlsx" or FileName endswith ".pdf"
| summarize TotalFiles=count() by bin(Timestamp, 5m), InitiatingProcessAccountName 
|where TotalFiles >100
| project TotalFiles,Timestamp,InitiatingProcessAccountName 

Analytic Rule Definition

id: 2d4f4889-ef25-4e3c-9ece-2275e55e8332
name: insider-threat-detection-queries (16)
description: |
  Intent:
  - Use MTP capability to look for insider threat potential risk indicators
  - Indicators would then serve as the building block for insider threat risk modeling in subsequent tools
  Definition of Insider Threat:
  "The potential for an individual who has or had authorized access to an organization's assets to use their access, either maliciously or unintentionally, to act in a way that could negatively affect the organization."
  This collection of queries describes the different indicators that could be used to model and look for patterns suggesting an increased risk of an individual becoming a potential insider threat.
  Note: no single indicator should be used as a lone determinant of insider threat activity, but should be part of an overall program to understand the increased risk to your organization's critical assets. This in turn is used to feed an investigation by a formal insider threat program to look at the context associated with the whole person to understand the implication of a set of indicators.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceFileEvents
tactics:
- Initial access
- Persistence
- Exfiltration
query: |
  // --------------------------------------------------------------------------------------------------------------------------- //
  //
  //High Volume File Copy Operation
  //
  //Copy large number of files (over 100) within a 5 minute timespan
  //Unfortunately there does not appear to be an easy way to determine that a file originated from a network share
  DeviceFileEvents
  | where FileName endswith ".docx" or FileName endswith ".pptx" or FileName endswith ".xlsx" or FileName endswith ".pdf"
  | summarize TotalFiles=count() by bin(Timestamp, 5m), InitiatingProcessAccountName 
  |where TotalFiles >100
  | project TotalFiles,Timestamp,InitiatingProcessAccountName 

Required Data Sources

False Positive Guidance

• Scenario: Scheduled Backup Job Using Veeam
  Description: A backup process (e.g., Veeam Backup & Replication) copies hundreds

MITRE ATT&CK Context

• Tactic: Initial access
• Tactic: Persistence
• Tactic: Exfiltration

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/General queries/insider-threat-detection-queries (16).yaml)